Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters

Vulnerability

Overview

CVE-2024-28123 is an out-of-bounds (OOB) buffer write vulnerability in the Wasmi WebAssembly interpreter, which is designed for efficient execution on constrained and embedded systems [1]. The flaw occurs specifically when the host (external caller) calls or resumes a Wasm function with more parameters than the default limit of 128 [3]. Because the interpreter's stack cannot handle this many parameters, it surpasses the stack value, leading to an out-of-bounds write [4]. Importantly, this vulnerability does not affect calls from Wasm to Wasm; only calls originating from the host side trigger the bug [1].

Exploitation and

Attack Surface

Exploitation requires an attacker to either directly control a host-to-Wasm function call with an excessive number of parameters (more than 128) or to influence a host application that accepts such calls from external users [3]. While functions with such a high parameter count are rare, the attack vector is serious when present [3]. Studies of dependent systems, such as Pallet Contracts, Parity Signer, and Smoldot, confirm that none are affected because they always limit host-to-Wasm calls to a small number of parameters [4].

Impact

If successfully exploited, an attacker can cause an out-of-bounds buffer write, potentially leading to memory corruption or undefined behavior in the interpreter [1]. The impact is limited to the security context of the host application embedding Wasmi, but given the interpreter's use in safety-critical environments, the OOB write could be leveraged for further compromise [4].

Mitigation

The vulnerability was patched in Wasmi version 0.31.1, released on 2023-12-01 [3]. Users running versions 0.15.0 through 0.31.0 should update immediately [4]. As a workaround, ensure that no host-to-Wasm function call passes more than 128 parameters [4]. The bug was responsibly disclosed to the Wasmi team by the Stellar Development Foundation [4].